T09 · Insecure Skill Coding Practices
- Location
modules/structure-patterns.md:157- Finding
Mandatory xtrace support can expose sensitive values in logs
- Content
View full analysis
Vulnerability Details
File Location:
modules/structure-patterns.md:157-169
Vulnerability Type: Sensitive information exposure through shell execution tracing
Risk Level: MediumVulnerable Code
sh ## xtrace support (-x / -t flags) Every executable script must support a flag to enable `xtrace` for debugging. The preferred flags are `-x` and `-t`. XTRACE=0 # …inside main() after arg parsing: case "${XTRACE}" in 1) set -x ;; esacTechnical Analysis
The guidance requires every executable script to support shell execution tracing through
set -x. When enabled, xtrace writes expanded commands and their arguments to stderr. This can include passwords, API tokens, signed URLs, credentials passed through command-line arguments, environment-derived secrets, private file paths, and other sensitive runtime values.The requirement provides no redaction mechanism, protected logging policy, exclusion for scripts that process secrets, or instruction to suspend tracing around sensitive operations. Consequently, scripts modified according to this guidance may expose confidential values in terminal output, CI logs, diagnostic captures, or retained build artifacts.
This is not automatic data exfiltration: a user or automation process must enable the tracing flag. Nevertheless, making the feature mandatory establishes a reusable disclosure channel in every reviewed executable script.
Attack Path
- The Skill reviews an executable shell script that handles credentials or other sensitive values.
- Following the mandatory structural rule, a developer adds
-xor-tsupport that executesset -x. - A developer, support operator, or CI job enables tracing while diagnosing a failure.
- The script executes commands containing expanded sensitive variables or arguments.
- The shell writes those expanded commands to stderr.
- CI systems, terminal recording, or l ...[truncated 723 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove the requirement that every executable script provide an xtrace flag.
-
Permit tracing only when it is explicitly justified for a script that does not process sensitive data.
-
Add guidance requiring tracing to be disabled before reading, expanding, or transmitting secrets:
sh set +x sensitive_operation "${SECRET:?SECRET must be set}" -
Do not pass secrets through command-line arguments, because process listings and trace output may expose them. Prefer protected files, standard input, or dedicated secret interfaces where supported.
-
Replace broad execution tracing with structured diagnostic logging that uses fixed format strings and explicitly redacts sensitive fields.
-
Ensure CI jobs do not enable xtrace globally and restrict access to diagnostic logs and retained artifacts.
-
Document that existing trace output must be treated as potentially sensitive and that exposed credentials must be revoked and rotated.
-